Systems and methods for generating hash trees and using neural networks to process the same

ABSTRACT

The present disclosure relates to systems and methods for generating a persona and detecting anomalies using a hash tree. In one implementation, the system may include one or more memories storing instructions and one or more processors configured to execute the instructions. The instructions may include instructions to receive a plurality of data structures related to an individual, convert the data structures into a plurality of Bayesian wavelets, group the Bayesian wavelets into a tree structure, using transitions between the Bayesian wavelets within the tree structure, generate a plurality of Markovian wavelets representing the transitions, replace one or more of the Bayesian wavelets with hashes, and output the tree structure as a persona representing the individual. The instructions may also include training a neural network.

CROSS REFERENCES TO RELATED APPLICATIONS

This application claims priority to U.S. Provisional Patent ApplicationNo. 62/673,547, filed May 18, 2018, which is incorporated herein byreference in its entirety.

TECHNICAL FIELD

The present disclosure relates generally to the field of neuralnetworks. More specifically, and without limitation, this disclosurerelates to systems and methods for using neural networks to process hashtrees.

BACKGROUND

Extant methods of risk detection generally are point-based. Accordingly,each new event (such as a transaction, a trip, a communication, or thelike) is modeled as a point and assessed with respect to a history ofpoints associated with the same person. However, such techniques sufferfrom relatively larger error rates and poor personalization. Forexample, fraud remains high even when reduced using such extanttechniques. Moreover, irrelevant or uninteresting communications arestill generated when such techniques are used to personalize offers orother communications.

More advanced models using neural networks have been developed butsuffer from low backwards-compatibility. For example, models developedusing TensorFlow cannot be applied to existing databases of eventswithout vast increases in processing power and memory capacity.Moreover, data intake for such systems is often too slow to provideon-demand decisions, e.g., for transactions, for authorization, or thelike.

SUMMARY

In view of the foregoing, embodiments of the present disclosure providesystems and methods for generating hash trees and processing the sameusing neural networks. The hash trees disclosed herein may providegreater accuracy and better personalization than existing point-basedtechniques.

Further, by employing the hash trees described herein, existingdatabases of events (such as transactions, itineraries, reservations,video recordings, audio recordings, emails, or the like) may be usedwithout significant increase in memory and processing capacities becauseembodiments of the present disclosure may be more efficient than extantneural networks. Moreover, hash trees as described herein may provideon-demand decisions on appropriate timescales (e.g., seconds fortransactions, minutes for authorization, or the like).

According to an example embodiment of the present disclosure, a systemfor generating a persona using a hash tree may comprise one or morememories storing instructions and one or more processors configured toexecute the instructions. The instructions may include instructions toreceive a plurality of data structures related to an individual, convertthe data structures into a plurality of Bayesian wavelets, group theBayesian wavelets into a tree structure, using transitions between theBayesian wavelets within the tree structure, generate a plurality ofMarkovian wavelets representing the transitions, replace one or more ofthe Bayesian wavelets with hashes, and output the tree structure as apersona representing the individual.

In another embodiment, a system for training a deep field network todetect anomalies within a hash tree may comprise one or more memoriesstoring instructions and one or more processors configured to executethe instructions. The instructions may include instructions to receive aplurality of tree structures representing individuals, each treestructure including Bayesian wavelets and Markovian wavelets governingtransitions between the Bayesian wavelets, group the Bayesian waveletsin the tree structures by coefficients, train a neural network for eachgroup independently of other groups, and integrate the neural networksinto a deep field network.

In another embodiment, a system for detecting anomalies within a hashtree comprises one or more memories storing instructions and one or moreprocessors configured to execute the instructions. The instructions mayinclude instructions to receive a new data structure related to anindividual, convert the data structure into a Bayesian wavelet, using atree structure of existing Bayesian wavelets associated with theindividual, calculate one or more harmonics, determine a measure ofwhether the Bayesian wavelet alters the one or more harmonics, and addthe Bayesian wavelet to the tree structure when the measure is below athreshold.

Any of the alternate embodiments for disclosed systems may apply todisclosed non-transitory computer-readable media storing instructionsfor methods disclosed herein.

It is to be understood that the foregoing general description and thefollowing detailed description are exemplary and explanatory only, andare not restrictive of the disclosed embodiments.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which comprise a part of this specification,illustrate several embodiments and, together with the description, serveto explain the principles disclosed herein. In the drawings:

FIG. 1 is a diagram of a wavelet tree structure, according to anexemplary embodiment of the present disclosure.

FIG. 2 is another diagram of a wavelet tree structure, according to anexemplary embodiment of the present disclosure.

FIG. 3 is a diagram of a Markovian wavelets governing transitionsbetween Bayesian wavelets, according to an exemplary embodiment of thepresent disclosure.

FIG. 4 is a diagram of a hashed tree structure, according to anexemplary embodiment of the present disclosure.

FIG. 5 is a diagram of harmonics within a tree structure, according toan exemplary embodiment of the present disclosure.

FIG. 6 is a block diagram of an exemplary system for generating treestructures from databases of events, according to an exemplaryembodiment of the present disclosure.

FIG. 7 is another block diagram of an exemplary system for generatingtree structures from databases of events, according to an exemplaryembodiment of the present disclosure.

FIG. 8 is a block diagram of an exemplary system for risk detectionusing tree structures, according to an exemplary embodiment of thepresent disclosure.

FIG. 9 is a diagram of an exemplary system for generating and using treestructures, according to an exemplary embodiment of the presentdisclosure.

FIG. 10 is a diagram of another exemplary system for generating andusing tree structures, according to an exemplary embodiment of thepresent disclosure.

FIG. 11 is a flowchart of an exemplary method for generating a personausing a hash tree, according to an exemplary embodiment of the presentdisclosure.

FIG. 12 is a flowchart of an exemplary method for training a deep fieldnetwork to detect anomalies within a hash tree, according to anexemplary embodiment of the present disclosure.

FIG. 13 is a flowchart of an exemplary method for detecting anomalieswithin a hash tree, according to an exemplary embodiment of the presentdisclosure.

FIG. 14 is a block diagram of an exemplary computing device with whichthe systems, methods, and apparatuses of the present disclosure may beimplemented.

DETAILED DESCRIPTION

The disclosed embodiments relate to systems and methods for generating apersona using a hash tree, training a deep field network to detectanomalies within a hash tree, and detecting anomalies within a hashtree. Embodiments of the present disclosure may be implemented using ageneral-purpose computer. Alternatively, a special-purpose computer maybe built according to embodiments of the present disclosure usingsuitable logic elements.

As used herein, “deep field network” refers to one or more trainedalgorithms integrated into a prediction schema. In some embodiments,deep field networks may be applied to a multi-nodal manifold converteddifferential field, e.g., determined based on the difference between awavelet converted to a tensor and a field of existing (e.g., previous)tensors.

Disclosed embodiments allow for efficient and accurate detection ofanomalies within a tree structure as well as determination of harmonicswithin the tree structure. Additionally, embodiments of the presentdisclosure allow for efficient and accurate authorization of new events(e.g., transactions, authorizations, or the like) or personalization ofcommunications based on the tree structure. Furthermore, embodiments ofthe present disclosure provide for greater flexibility and accuracy thanextant anomaly detection techniques, such as rule-based determinations,decision trees, and neural networks.

As used herein, a “tree structure” may refer to any chainifiedrepresentation of data objects. For example, the tree structure maycomprise a hash structure (e.g., a Merkel tree or the like), ablockchain (e.g., a chain of verified blocks representing transactions,or other events), or any other similar structure organized in a tree(e.g., as depicted in FIGS. 1-4, described below).

According to an aspect of the present disclosure, a processor mayreceive a plurality of data structures related to an individual. Forexample, the data structures may be received from one or more memories(e.g., a volatile memory such as a random access memory (RAM) and/or anon-volatile memory such as a hard disk) and/or across one or morecomputer networks (e.g., the Internet, a local area network (LAN), orthe like). The data structures may represent transactions havingassociated properties (such as time, location, merchant, amount, etc.),reservations having associated information (such as a name, anidentification number, a time, a merchant, etc.), emails sent to aperson, or any other discrete event represented in a bundle of data.

In some embodiments, the processor may convert the data structures intoa plurality of Bayesian wavelets. As used herein, the term “wavelet”refers to any data that may be represented as a brief oscillation. Forexample, an oscillation with an amplitude rising from zero to a maximumand returning to zero over a finite period of time comprises an exampleof a wavelet. A transaction may be visualized as a wavelet in whichcurrency and/or commodity is temporarily disturbed by transfer betweenparties. The wavelet representing the transaction may be indexed bylocation, time, category of transaction (e.g., furniture, contractorservices, grocery, or the like), and/or other indicators. Similarly, areservation may be visualized as a wavelet in which currency and/orcapacity (e.g., of rooms, of vehicles, or the like) is temporarilydisturbed. The wavelet representing the reservation may be indexed bylocation, time, amount (e.g., number of vehicles and/or days, number ofrooms and/or days, or the like), and/or other indicators.

The wavelet need not be received in the form of an oscillation but maybe represented in any appropriate form (e.g., an array, a digitalsignal, or the like). A wavelet is “Bayesian” if the wavelet depends ona history of an event represented by the wavelet. For example, theprocessor may update the wavelet over time depending on an evolvinghistory of the event. For example, a wavelet associated with areservation may change state over time when booked, when checked in, andwhen complete. As another example, a wavelet associated with atransaction may change state over time when initiated, when authorized,and when paid.

In some embodiments, the processor may group the Bayesian wavelets intoa tree structure. For example, the Bayesian wavelets may be organizedalong at least one dimension in time such that Bayesian transformationsof the wavelets occur along the at least one dimension. Additionally oralternatively, the Bayesian wavelets may be grouped with respect tochannel. For example, the source of the data structures (and, thus, ofthe corresponding Bayesian wavelets) may comprise the channel.Accordingly, Bayesian wavelets representing emails may be groupedseparately from Bayesian wavelets representing phone call logs. Inanother example, Bayesian wavelets representing brick-and-mortartransactions may be grouped separately from Bayesian waveletsrepresenting online transactions.

Each wavelet may include one or more coefficients (e.g., in a Fourierseries representing the oscillation). Accordingly, the processor maygroup the wavelets into a tree structure by these coefficients.Additionally or alternatively, in embodiments using tensors as describedbelow, each tensor includes coefficients for each base in the set ofbases representing a corresponding multi-dimensional space in which thetensor may be represented. Accordingly, the processor may group thetensors (and therefore, the corresponding wavelets) into a treestructure by these coefficients. Because the coefficients depend on thebases selected (which must satisfy one or more mathematical rules inorder to form a mathematically consistent multi-dimensional space), theprocessor may generate a plurality of groups of coefficients and, thus,a plurality of groupings of the tensors (with the correspondingwavelets). Accordingly, a plurality of tree structures may be formeddepending on which bases are selected. For example, the processor mayselect bases depending on which factors are most heavily weighted in oneor more predictive models and then perform a plurality of groupings intotree structure, each for a particular model (or set of models) havingfactors corresponding to the bases used to determine the correspondingtree structure.

In some embodiments, using transitions between the Bayesian waveletswithin the tree structure, the processor may generate a plurality ofMarkovian wavelets representing the transitions. As used herein, a“Markovian wavelet” may refer to any data structure representing atransition matrix between wavelets (e.g., Bayesian wavelets). AMarkovian wavelet may represent a transition between one state toanother state for a Bayesian wavelet of the same object (e.g., atransaction, a reservation, or the like) or between one Bayesian waveletand a different Bayesian wavelet (e.g., from an email to a transaction,from a phone call to a reservation, or the like).

In some embodiments, the processor may replace one or more of theBayesian wavelets with hashes. For example, as depicted in FIG. 1, aportion of the tree structure may comprise a hash tree for one or moreof the Bayesian wavelets. Additionally or alternatively, the processormay hash each Bayesian wavelet separately from other wavelets (thusforming individual hashes rather than a hash tree).

In some embodiments, the processor may output the tree structure as apersona representing the individual. For example, the persona may bestored for later use in prediction, personalization, and/or riskassessment, as described herein.

In some embodiments, the processor may convert the Bayesian wavelets totensors that are output with the tree structure. For example, a tensormay represent an array that satisfies one or more mathematical rules(for example, a tensor may be a multi-dimensional array with respect toone or more valid bases of a multi-dimensional space). In suchembodiments, the processor may convert the wavelets to tensors using amoving average. For example, a simple moving average, a cumulativemoving average, a weighted moving average, or the like, may be used toconvert the wavelets to tensors. In certain aspects, the processor mayconvert the wavelets to tensors using an exponential smoothing average.By using an exponential smoothing average, the natural base e may beincorporated into the smoothing. Because e represents the limit ofcompound interest, the smoothed wavelet may be easier to identify asanomalous within a financial market. Accordingly, the processor mayperform a discrete wavelet transform with an exponential smoothingaverage accumulator to transform the wavelets into tensors.

According to another aspect of the present disclosure, a processor mayreceive a plurality of tree structures representing individuals. Asdescribed above, each tree structure including Bayesian wavelets andMarkovian wavelets governing transitions between the Bayesian wavelets.The data structures may be received from one or more memories (e.g., avolatile memory such as a random access memory (RAM) and/or anon-volatile memory such as a hard disk) and/or across one or morecomputer networks (e.g., the Internet, a local area network (LAN), orthe like). The data structures may represent transactions havingassociated properties (such as time, location, merchant, amount, etc.),reservations having associated information (such as a name, anidentification number, a time, a merchant, etc.), emails sent to aperson, or any other discrete event represented in a bundle of data.

In some embodiments, the processor may group the Bayesian wavelets inthe tree structures by coefficients. For example, each wavelet mayinclude one or more coefficients (e.g., in a Fourier series representingthe oscillation). Accordingly, the processor may group the wavelets bythese coefficients. Additionally or alternatively, in embodiments usingtensors as described below, each tensor includes coefficients for eachbase in the set of bases representing a corresponding multi-dimensionalspace in which the tensor may be represented. Accordingly, the processormay group the tensors (and therefore, the corresponding wavelets) bythese coefficients. Because the coefficients depend on the basesselected (which must satisfy one or more mathematical rules in order toform a mathematically consistent multi-dimensional space), the processormay generate a plurality of groups of coefficients and, thus, aplurality of groupings of the tensors (with the corresponding wavelets).For example, the processor may select bases depending on which factorsare most heavily weighted in one or more predictive models and thenperform a plurality of groupings, each for a particular model (or set ofmodels) having factors corresponding to the bases used to determine thecorresponding group.

In some embodiments, the processor may train a neural network for eachgroup independently of other groups. Although “neural network” usuallyrefers to a traditional artificial neural network, the processor heremay train any model (e.g., the models discussed above with respect tothe groupings) that produces a likelihood of a particular wavelet (orcorresponding tensor) being anomalistic within a group. By training eachgroup independently, the processor may develop specialized models thatare orders of magnitude greater in number (and, therefore, accuracy)than extant neural networks. For example, the processor may developthousands (or even millions) of models without requiring exponentiallymore resources than used to construct a single artificial neuralnetwork.

In some embodiments, the processor may integrate the neural networksinto a deep field network. For example, the models may be combined intoa larger predictive scheme. In one particular example, the models may becombined such that when a new wavelet (or corresponding tensor) isconvolved (or otherwise combined with the models), the model trained onthe group (or groups) having the most similar coefficients will beamplified while other models (e.g., trained on groups with less similarcoefficients) will be minimized.

In some embodiments, the processor may further convert the Bayesianwavelets to tensors further used to train the neural network for eachgroup. For example, as explained above, the processor may convert thewavelets to tensors using a moving average. For example, a simple movingaverage, a cumulative moving average, a weighted moving average, or thelike, may be used to convert the wavelets to tensors. In certainaspects, the processor may convert the wavelets to tensors using anexponential smoothing average. By using an exponential smoothingaverage, the natural base e may be incorporated into the smoothing.Because e represents the limit of compound interest, the smoothedwavelet may be easier to identify as anomalous within a financialmarket. Accordingly, the processor may perform a discrete wavelettransform with an exponential smoothing average accumulator to transformthe wavelets into tensors.

According to another aspect of the present disclosure, a processor mayreceive a new data structure related to an individual. For example, asexplained above, the new data structure may be received from one or morememories (e.g., a volatile memory such as a random access memory (RAM)and/or a non-volatile memory such as a hard disk) and/or across one ormore computer networks (e.g., the Internet, a local area network (LAN),or the like). The new data structure may represent a transaction havingassociated properties (such as time, location, merchant, amount, etc.),reservation having associated information (such as a name, anidentification number, a time, a merchant, etc.), email sent to theindividual, or any other discrete event represented in a bundle of data.

In some embodiments, the processor may convert the data structure into aBayesian wavelet. Moreover, using a tree structure of existing Bayesianwavelets associated with the individual, the processor may calculate oneor more harmonics. For example, as explained with respect to FIG. 5,Markovian wavelets may describe transition probabilities between theBayesian wavelets from which the harmonics may be calculated.

In some embodiments, the processor may determine a measure of whetherthe Bayesian wavelet alters the one or more harmonics. In someembodiments, the “measure” may refer to a percentage (e.g., 50%, 60%,70%, etc.), a set of odds (e.g., 1:3, 1 in 5, etc.), a score (e.g., 1out of 5, 5.6 out of 10.0, etc.), an indicator (e.g., “not likely,”“likely,” “very likely,” etc.), or the like. Additionally oralternatively, the “measure” may refer to a magnitude and/or direction(depending on whether the measure is a scalar or a vector) to the one ormore harmonics caused by the new wavelet.

In some embodiments, the processor may add the Bayesian wavelet to thetree structure when the measure is below a threshold. For example, theprocessor may add the new wavelet to the tree structure when thelikelihood is below a threshold. If the processor rejects the newwavelet, the processor may send a notification to such effect. Forexample, the processor may send a rejection signal or a messageindicating the likelihood and/or a reason (e.g., based on the one ormore models) for rejection. The processor may send the notification toone or more parties associated with the new wavelet (e.g., a financialinstitution, an individual, a merchant, or the like) and/or to one ormore computer systems from which the new wavelet was received (e.g., apersonal computer such as a desktop computer or mobile phone, apoint-of-service system, a financial processing server, a credit bureauserver, or the like).

Accordingly, as explained above, the harmonics may be used to detectanomalies. Additionally or alternatively, one or more models (e.g.,trained as described above) may be applied to new wavelets to detectanomalies.

In one example using models to detect anomalies, the processor mayfurther convert the Bayesian wavelet to a tensor. In such embodiments,the measure of whether the Bayesian wavelet alters the one or moreharmonics may be based on a differential field between the tensor and afield representing the tree structure.

For example, the processor may have performed a discrete wavelettransform with an exponential smoothing average accumulator to transformone or more Bayesian wavelets of the tree structure into tensors andthen obtain the field by mapping the tensors onto a manifold (e.g., adifferential manifold). One or more atlases may be used in order to doso. In some embodiments, the difference field may represent a tensorproduct of fields (i.e., between a field having only the tensorcorresponding to the new Bayesian wavelet and the field having Bayesianwavelets from the tree structure represented as tensors). Accordingly,the difference field may represent a Galois connection between thetensor and the field.

In some embodiments, processor may perform a weighted summation of thedifference field to produce a difference vector. For example, thecoefficient weights may be derived from training of one or moreparticular models. For example, the processor may apply a variety ofmodels in the weighting, such as models trained for particularidentifiers (e.g., particular tree structures, particular merchants,particular institutions, etc.), particular times (e.g., time of day,time of year, etc.), particular locations (e.g., particular country,particular city, particular postal code, etc.), or the like.

Additionally or alternatively, the summation may include a notch filter.Accordingly, particular frequencies may be filtered out during thesummation. For example, the processor may apply one or more particularmodels to determine which particular frequencies to filter out. The oneor more filter models may be the same models as the one or moreweighting models or may be different models.

In some embodiments, an absolute or a squaring function may be applied.Alternatively, the weighted summation may produce a directionaldifference vector. Accordingly, the difference vector may include adirection of the difference as well as a magnitude of the difference.This additional information may improve accuracy of the anomalydetection. For example, a large difference vector pointing in anexpected direction may be less anomalous than a small difference vectorpointing in an unexpected direction. Accordingly, at least one of aharmonic difference (whether scalar or vector) or a difference field maybe used to assess how anomalous a new wavelet is.

The anomalousness of a new wavelet may represent its risk. As usedherein, “risk” refers to any quantification of the probability of anevent being unrelated to or unauthorized by a person, such as atransaction being lost (e.g., via automatic decline, insolvency of thepurchaser, fraudulency, or the like), a reservation being cancelled(e.g., due to accidental or fraudulent booking or the like).Accordingly, “high risk” may refer to any level of risk that exceeds anacceptable level, whether the acceptable level be predetermined ordynamically determined (e.g., certain purchasers, merchants, regions,times of day, or the like may have differing acceptable levels of risk).

Based on riskiness, the processor may authorize or deny a new event(e.g., reject new data from sensors, such as a video or audio recording,as unrelated to the individual, deny a new transactions, require adeposit for a new reservation, or the like). For example, the processormay authorize the event when the likelihood is below a threshold. If theprocessor rejects the new wavelet, the processor may send a notificationto such effect. For example, the processor may send a rejection signalor a message indicating the likelihood and/or a reason (e.g., based onthe one or more models) for rejection. The processor may send thenotification to one or more parties associated with the new wavelet(e.g., a financial institution, an individual, a merchant, or the like)and/or to one or more computer systems from which the new wavelet wasreceived (e.g., a personal computer such as a desktop computer or mobilephone, a point-of-service system, a financial processing server, acredit bureau server, or the like).

In some embodiments, based on the likelihood, the processor may requestadditional information. For example, as explained above, the processormay request a deposit before authorizing a reservation. In anotherexample, the processor may request manual verification beforeauthorizing a transaction. For example, if the likelihood is above afirst threshold but below a second threshold, the processor may send oneor more messages to one or more parties associated with the new wavelet(e.g., a financial institution, an individual, a merchant, or the like)with a request to provide a deposit, send manual confirmation, or thelike. In such an example, the processor may send a message to a mobilephone and/or email address of the individual to request that the newwavelet be verified (e.g., by sending a “Y,” “yes,” or other affirmativeresponse), that a deposit be provided (e.g., via credit card or thelike). Additionally or alternatively, the processor may send a messageto a merchant warning that a suspicious transaction has been processedand that the merchant will be denied future transactions if the numberof suspicious transactions in a period of time exceeds a threshold. Inanother example, the processor may send a message to a merchant warningthat a higher-risk reservation has been processed and including anindication of the risk of cancellation.

In some embodiments, the harmonics and/or model(s) may additionally oralternatively be used for prediction or personalization. For example,the harmonics may be used to determine effective channels forcommunication (e.g., email or phone or the like), effective offers tosend (e.g., to produce a transaction or other engagement), topics ofinterest (e.g., for a search engine to return or otherwise promote), orthe like. Additionally or alternatively, the model(s) may determine thesame.

Turning now to FIG. 1, there is shown an example of a tree structure.For example, hG1, hG2, and hGn represent Bayesian wavelets within thetree structure. As shown in FIG. 1, hash values associated with theseBayesian wavelets are connected to corresponding wavelets in the treestructure. As further depicted in FIG. 1, one or more Bayesian waveletsmay transform over time, e.g., wavelets hG2 and hGn transform to hG3 andare thus connected to hG3 in the tree. The tree structure shown in FIG.1 may comprise a portion of a tree structure used in any of theembodiments described below. The hash values shown in FIG. 1 may allowfor anonymized use of wavelets included in the tree structure (e.g., fordemographic calculations or the like). Alternatively, embodimentsdescribed below may comprise Bayesian wavelets in a tree structurewithout any corresponding hash values. For example, non-anonymousprocessing of data (e.g., to authorize transactions or the like).

FIG. 2 depicts an exemplary tree structure. The tree structure shown inFIG. 2 includes only Bayesian wavelets but may also include hash values,as depicted in FIG. 1. As shown in FIG. 2, the Bayesian wavelets areorganized along a vertical axis according to history; accordingly, asBayesian wavelets transform over time, the updated wavelets are addedfurther down the tree from the previous wavelets. Similarly, alternatestates are arranged along a horizontal axis. Accordingly, the horizontalaxis is associated with Markovian wavelets while the vertical axis isassociated with Bayesian wavelets. As Bayesian wavelets transform overtime, new possible wavelets are added with the most likely possibilitiesfurther down than less likely possibilities. Moreover, as shown in FIG.2, the wavelets may be grouped along the vertical axis by channel.

FIG. 3 depicts the exemplary tree structure of FIG. 2 with additionaldetail. In particular, Markovian wavelets that govern transitionsbetween the Bayesian wavelets are depicted. As explained in FIG. 3,Markovian wavelets track transitions between Bayesian wavelets, whetheracross time (e.g., from initiation to completion of a transaction orreservation or the like) or across channels (e.g., from an email to acorresponding transaction, from a phone call to a correspondingreservation, or the like). Harmonics may be determine from the Bayesianwavelets, the Markovian wavelets, or both.

FIG. 4 depicts the exemplary tree structure of FIG. 2 with a hash treesuch as that of FIG. 1. As depicted in FIG. 4, a merchant category code(mcc) may be hashed with a corresponding zip code of a firsttransaction. Moreover, a card not present (cnp) indicator may be hashedwith a corresponding Internet protocol (ip) address of a secondtransaction. The two transactions may be hashed together if related(e.g., by time, by merchant, by individual, or the like). Moreover, bothtransactions may further be hashed with an indication of a country(cntry) in which they were performed. Thus, a tree structure similar toa Merkle tree may form at least part of the tree structures generatedand used in embodiments of the present disclosure.

FIG. 5 depicts the exemplary tree structure of FIG. 2 with possibleharmonics. In particular, the plurality of transitions between Bayesianwavelets may exhibit harmonics that tend toward transitions from waveletA to wavelet C. These harmonics may allow determination of an effectivecampaign (e.g., using a communication like wavelet A to trigger areservation or transaction like wavelet C) or the like. Additionally oralternatively, the harmonics may be used to calculate moving averages oftransactions, reservations, or the like. Accordingly, a merchant orother vendor may determine the impact of fraud, charegebacks,cancellations, or the like from the moving averages in a significantlyshorter amount of time than with extant systems.

FIG. 6 depicts an exemplary system 600 for generating hash trees. System600 may be implemented on one or more servers, such as detection server1401 of FIG. 14. The one or more servers may be housed on one or moreserver farms. As depicted in FIG. 6, system 600 may generate Bayesianwavelets 601, e.g., from one or more data structures associated with anindividual, a merchant, or the like. For example, as explained above,the data structures may be received by system 600 (e.g., from one ormore memories and/or over one or more computer networks) and thuswavelets 601 may be determined by system 600 based on the datastructures (e.g., one or more transactions, one or more reservations,one or more communications, or the like) received by system 600.

As further depicted in FIG. 6, system 600 may convert wavelets 601 to ahash tree 603. For example, as described above, system 600 may organizethe Bayesian wavelets along at least one dimension in time such thatBayesian transformations of the wavelets occur along the at least onedimension of tree structure 603 and/or group the Bayesian waveletswithin tree structure 603 with respect to channel. Additionally oralternatively, each wavelet may include one or more coefficients (e.g.,in a Fourier series representing the oscillation) and thus system 600may group the wavelets into tree structure 603 by these coefficients.

In some embodiments, although not depicted in FIG. 6, system 600 mayperform a discrete wavelet transform (e.g., a cascading convolution)with a smoothing accumulator to transform the wavelets 601 to tensors.In some embodiments, a simple moving average, a cumulative movingaverage, a weighted moving average, or the like, may be used forsmoothing. In certain aspects, the smoothing may be an exponentialsmoothing average. By using an exponential smoothing average, thenatural base e may be incorporated into the smoothing.

In embodiments using tensors as described below, each tensor may includecoefficients for each base in the set of bases representing acorresponding multi-dimensional space in which the tensor may berepresented. Accordingly, system 600 may group the tensors (andtherefore, the corresponding wavelets 601) into tree structure 603 bythese coefficients. Because the coefficients depend on the basesselected (which must satisfy one or more mathematical rules in order toform a mathematically consistent multi-dimensional space), system 600may generate a plurality of groups of coefficients and, thus, aplurality of groupings of the tensors (with the corresponding wavelets601). Accordingly, a plurality of tree structures 603 may be formeddepending on which bases are selected. For example, as explained above,system 600 may select bases depending on which factors are most heavilyweighted in one or more predictive models and then perform a pluralityof groupings into tree structure, each for a particular model (or set ofmodels) having factors corresponding to the bases used to determine thecorresponding tree structure.

In some embodiments, as further depicted in FIG. 6, system 600 mayconvert tree structure 603 (and/or corresponding tensors) to one or morefields 605. For example, system 600 may use one or more atlases to maptree structure 603 (and/or corresponding tensors) onto one or moremanifolds to form one or more fields 605. In some embodiments, system600 may select the one or more atlases to ensure particular propertiesof the resulting manifold (e.g., to result in a differential manifold, asmooth manifold, an analytic manifold, a complex manifold, or the like).

Field 605 and/or harmonics from tree structure 603 may be used by system600 to detect anomalous wavelets, as explained above. For example,system 600 may calculate a difference field between a new wavelet and acorresponding field 605 and may sum the difference field to form adifference vector. Accordingly, the magnitude and/or direction of thedifference vector may be used to determine an anomaly likelihood (e.g.,using one or more models, as explained above). Additionally oralternatively, a harmonic difference (whether a scalar or vector) may beused to determine an anomaly likelihood (e.g., using one or more models,as explained above).

FIG. 7 depicts another exemplary system 700 for generating hash trees.System 700 may be implemented on one or more servers, such as detectionserver 1401 of FIG. 14. The one or more servers may be housed on one ormore server farms. Similar to system 600 of FIG. 6, system 700 generateswavelets 701, converts wavelets 701 to a tree structure 703, and mapstree structure 703 (and/or corresponding tensors) to one or more fields705. In addition, as depicted in FIG. 7, system 700 generates wavelets701 based on received data structures comprising JavaScript ObjectNotation (JSON) data. Additional or alternative data serializationformats, such as Extensible Markup Language (XML), YAML Ain't MarkupLanguage (YAML), or the like. Data serialization formats allow for rapidand lightweight transmission of data (e.g., transactions) to system 700.In addition, data serialization formats may allow for direct use of thereceived data (e.g., for conversion to wavelets or even for directprocessing by a discrete wavelet transform) without having toreconstruct a data structure or object therefrom. Furthermore, manyextant database structures (such as MongoDB, Oracle NoSQL Database, orthe like) support native exportation directly to a data serializationformat such as JSON. Accordingly, accepting data serialization formatsmay allow for faster and more native integration with existingtransaction databases.

FIG. 8 depicts another exemplary system 800 for detecting anomalouswavelets. System 800 may be implemented on one or more servers, such asdetection server 1401 of FIG. 14. The one or more servers may be housedon one or more server farms. As depicted in FIG. 8, system 800 maygenerate a new Bayesian wavelet 801, e.g., from a new data structuresassociated with an individual, a merchant, or the like. For example, asexplained above, the new data structure may be received by system 800(e.g., from one or more memories and/or over one or more computernetworks) and thus wavelet 801 may be determined by system 800 based onthe new data structure (e.g., one or more transactions, one or morereservations, one or more communications, or the like) received.

As further depicted in FIG. 8, system 800 may receive a tree structure803, e.g., associated with a same individual, merchant, or the like, asnew Bayesian wavelet 801. Although depicted as a hash tree, the treestructure may comprise only Bayesian wavelets without hashes. Treestructure 803 may be retrieved by system 800 from one or more memoriesand/or over one or more computer networks.

As further depicted in FIG. 8, system 800 may convert new wavelet 801 aswell as wavelets from tree structure 803 into tensors 805. For example,system 800 may perform a discrete wavelet transform (e.g., a cascadingconvolution) with a smoothing accumulator to transform the wavelet 801and wavelets from tree structure 803 to tensors 805. In someembodiments, a simple moving average, a cumulative moving average, aweighted moving average, or the like, may be used for smoothing. Incertain aspects, the smoothing may be an exponential smoothing average.By using an exponential smoothing average, the natural base e may beincorporated into the smoothing.

As further depicted in FIG. 8, system 800 may apply one or more models(e.g., neural networks 807) to determine whether new wavelet 801 isanomalous. For example, system 800 may calculate a difference fieldbetween the tensor representing new wavelet 801 and a correspondingfield representing tensors from tree structure 803 and may sum thedifference field to form a difference vector. Accordingly, the magnitudeand/or direction of the difference vector may be used to determine ananomaly likelihood (e.g., using one or more models 807). Additionally oralternatively, although not depicted in FIG. 8, a harmonic difference(whether a scalar or vector) between wavelet 801 and tree structure 803may be used to determine an anomaly likelihood (e.g., using one or moremodels 807).

FIG. 9 depicts an exemplary system 900 for generating and using treestructures as described herein. For example, system 900 may represent anadditional or alternative device to detection server 1401 of FIG. 14 forimplementing methods disclosed herein.

As depicted in FIG. 9, one or more sources of data structures forsystems of the present disclosure may include one or more data lakescomprising a distributed file system (such as Apache Hadoop or the like)that are sent through a stream and output as JSON objects. Although notdepicted in FIG. 9, additional sources may include one or more datalakes comprising images (such as Microsoft Azure Data Lake or the like),one or more real-time online transaction processing systems (RT-OLTPS)(such as PayPal or the like), and/or one or more data oceans (such asJSON objects exchanged using a Representational State Transfer (REST)protocol, XML objects exchanged using a Simple Object Access Protocol(SOAP), or the like). Additional sources may include a user interface(e.g., depicted as a web console in FIG. 9), external data providers(e.g., third-party servers), or the like. Although depicted as usingJSON objects, other data serialization formats such as XML, YAML, or thelike, may be used in lieu of or in combination with JSON objects.

A multi-process controller (depicted as the go hyperlink controller inFIG. 9 but may comprise any appropriate controller) may manage thedifferent data feeds providing data structures for conversion towavelets. As depicted in FIG. 9, one or more information theoryprocesses may convert incoming data structures to trees of wavelets,wavelets to tensors, and/or tensors to fields, as described herein. Asexplained above, the trees, tensors, and/or fields may be stored, e.g.,in Redis or any other appropriate database protocol. In addition, one ormore models may be trained on the trees, tensors, and/or fields (e.g.,according to method 1100 of FIG. 11) and then stored in a cache forlater use. Although depicted as local, the storages may additionally oralternatively be remote from system 900.

As further depicted in FIG. 9, statistics may be read off the trees,tensors, and/or fields in real time. For example, as explained above,harmonics of the tree structures may be used to determine movingaverages for any variables included in or associated with the datastructures input into system 900. As shown in FIG. 9, multiplestatistics may be read off in parallel in real time. Accordingly, thetree structures of the present disclosure may allow for faster and moreaccurate statistics provided to owners of the data structures.

FIG. 10 depicts an exemplary system 1000 of constructing and using adatabase comprising discrete wavelets. For example, system 1000 mayrepresent an additional or alternative device to detection server 1401of FIG. 14 for implementing methods disclosed herein. System 1000 mayprovide for a faster generation and use of tree structure than system900, described above. For example, system 1000 may use fewer datasources and/or omit model generation to provide for faster conversion ofinput data structures and reduce overhead. System 1000 may still providereal time statistics to owners of the data structures while using fewerresources than system 900.

FIG. 11 is a flowchart of exemplary method 1100 for generating a personausing a hash tree. Method 1100 may be implemented using ageneral-purpose computer including at least one processor, e.g.,detection server 1401 of FIG. 14. Alternatively, a special-purposecomputer may be built for implementing method 1100 using suitable logicelements.

At step 1101, a plurality of data structures related to an individual.The data structures may be received from one or more memories and/oracross one or more computer networks. For example, the processor mayreceive a transaction having associated properties (such as time,location, merchant, amount, etc.), a reservation, or the like. The datastructure may be received in and/or converted to one or more dataserialization formats, such as JSON, XML, YAML, etc.

At step 1103, the processor may convert the data structures into aplurality of Bayesian wavelets. The wavelet need not be received in theform of an oscillation but may be represented in any appropriate form(e.g., an array, a digital signal, or the like). Accordingly, theprocessor may convert the data structures to arrays or any otherappropriate data form representing the Bayesian wavelets.

In some embodiments, the processor may further convert the Bayesianwavelets to tensors. For example, as explained above, the processor mayconvert the wavelet to a tensor based using a moving average, such as asimple moving average, a cumulative moving average, a weighted movingaverage, an exponential moving average, or the like. Accordingly, theprocessor may perform a cascading convolution (e.g., with one or morefilter banks) followed by an accumulation (e.g., using the movingaverage for smoothing) to transform the received wavelet into a tensor.

At step 1105, the processor may group the Bayesian wavelets into a treestructure. For example, as explained above, the processor may organizethe Bayesian wavelets along at least one dimension in time such thatBayesian transformations of the wavelets occur along the at least onedimension. Additionally or alternatively, the processor may group theBayesian wavelets with respect to channel. For example, the source ofthe data structures (and, thus, of the corresponding Bayesian wavelets)may comprise the channel. Accordingly, the processor may group Bayesianwavelets representing emails separately from Bayesian waveletsrepresenting phone call logs, Bayesian wavelets representingbrick-and-mortar transactions separately from Bayesian waveletsrepresenting online transactions, or the like

Each Bayesian wavelet may include one or more coefficients (e.g., in aFourier series representing the oscillation). Accordingly, the processormay group the wavelets into a tree structure by these coefficients.Additionally or alternatively, in embodiments using tensors as describedabove, each tensor may include coefficients for each base in the set ofbases representing a corresponding multi-dimensional space in which thetensor may be represented. Accordingly, the processor may group thetensors (and therefore, the corresponding wavelets) into the treestructure by these coefficients. Because the coefficients depend on thebases selected (which must satisfy one or more mathematical rules inorder to form a mathematically consistent multi-dimensional space), theprocessor may generate a plurality of groups of coefficients and, thus,a plurality of groupings of the tensors (with the correspondingwavelets). Accordingly, a plurality of tree structures may be formeddepending on which bases are selected. For example, the processor mayselect bases depending on which factors are most heavily weighted in oneor more predictive models and then perform a plurality of groupings intotree structure, each for a particular model (or set of models) havingfactors corresponding to the bases used to determine the correspondingtree structure.

At step 1107, using transitions between the Bayesian wavelets within thetree structure, the processor may generate a plurality of Markovianwavelets representing the transitions. For example, the processor maygenerate matrices, arrays, or any other data structures comprising theMarkovian wavelets that describe transition probabilities between theBayesian wavelets.

At step 1109, the processor may replace one or more of the Bayesianwavelets with hashes. For example, the processor may apply a hashfunction to one or more values (e.g., properties, metadata, or the like)included in the Bayesian wavelet). In some embodiments, the processormay generate hash trees (e.g., Merkle hash trees or the like) to includein the overall tree structure.

At step 1111, the processor may output the tree structure (or, in someembodiments, the plurality of tree structures) as a persona representingthe individual. In embodiments where the processor calculated tensors,the processor may further output the tensors.

The tree structure generated by method 1100 may have various uses. Forexample, as explained above, the processor may calculate one or moreharmonics based on the Markovian wavelets (and/or the Bayesian wavelets)and use the harmonics to determine whether a new wavelet is anomalous(e.g., if it alters the harmonics by more than a threshold) and/or tocalculate moving averages of properties associated with the wavelets. Inanother example, the processor may determine an effective channel ofcommunication or other personalization for an individual or other entityto produce a particular outcome (e.g., initialization of a transaction,non-cancellation of a reservation, or the like). In yet another example,the processor may calculate a field based on the tree structure and usethe field to determine a difference vector to see if a tensor associatedwith a new wavelet is anomalous (e.g., based on one or more thresholdsapplied to the difference vector).

FIG. 12 is a flowchart of exemplary method 1200 for training a deepfield network to detect anomalies within a hash tree. Method 1200 may beimplemented using a general-purpose computer including at least oneprocessor, e.g., detection server 1401 of FIG. 14. Alternatively, aspecial-purpose computer may be built for implementing method 1200 usingsuitable logic elements.

At step 1201, a processor may receive a plurality of tree structuresrepresenting individuals. Each tree structure may include Bayesianwavelets and Markovian wavelets governing transitions between theBayesian wavelets. For example, the processor may receive a treestructure representing an individual, a merchant or other vendor, alocation, or the like. The tree structure may be received in and/orconverted to one or more data serialization formats, such as JSON, XML,YAM L, etc.

At step 1203, the processor may group the Bayesian wavelets in the treestructures by coefficients. For example, as explained above, eachwavelet may include one or more coefficients (e.g., in a Fourier seriesrepresenting the oscillation). Accordingly, the processor may group thewavelets by these coefficients. Additionally or alternatively, inembodiments using tensors as described below, each tensor includescoefficients for each base in the set of bases representing acorresponding multi-dimensional space in which the tensor may berepresented. Accordingly, the processor may group the tensors (andtherefore, the corresponding wavelets) by these coefficients. Becausethe coefficients depend on the bases selected (which must satisfy one ormore mathematical rules in order to form a mathematically consistentmulti-dimensional space), the processor may generate a plurality ofgroups of coefficients and, thus, a plurality of groupings of thetensors (with the corresponding wavelets). For example, the processormay select bases depending on which factors are most heavily weighted inone or more predictive models and then perform a plurality of groupings,each for a particular model (or set of models) having factorscorresponding to the bases used to determine the corresponding group.

At step 1205, the processor may train a neural network for each groupindependently of other groups. The processor at step 1205 may train anymodel (e.g., the models discussed above with respect to the groupings)that produces a likelihood of a particular wavelet being anomalisticwithin a tree structure. As used herein, the term “train” refers to theadjustment of one or more parameters of the model (such as coefficients,weights, constants, or the like) to increase accuracy of the model(e.g., to match known properties of the wavelets in each group).

Additionally with or alternatively to training a neural network for eachgroup, the processor may train each neural network specific to at leastone of a particular tree structure, a particular location, or aparticular time of day. Accordingly, the models may be specific topersons, merchants, products, services, locations, times, communicationchannels, or the like.

At step 1207, processor may integrate the neural networks into a deepfield network. For example, the models may be combined into a largerpredictive scheme. In one particular example, the models may be combinedsuch that when a new tensor is convolved (or otherwise combined with themodels), the model trained on the group (or groups) having the mostsimilar coefficients will be amplified while other models (e.g., trainedon groups with less similar coefficients) will be minimized.

The models trained by method 1200 may have various uses. For example, asexplained above, the processor may apply the models to new wavelets todetermine whether the new wavelets are anomalous (and therefore likelyfraudulent, accidental, or the like). Additionally or alternatively, theprocessor may apply the models to identify personalization, effectivecommunication channels, or other techniques for increasing thelikelihood of certain transitions (e.g., of triggering particulartransactions, reservations, or other events). Additionally oralternatively, the processor may apply the models to deduce movingaverages or other statistics from the tree structure.

FIG. 13 is a flowchart of exemplary method 1300 for detecting anomalieswithin a hash tree. Method 1300 may be implemented using ageneral-purpose computer including at least one processor, e.g.,detection server 1401 of FIG. 14. Alternatively, a special-purposecomputer may be built for implementing method 1300 using suitable logicelements.

At step 1301, a processor may receive a new data structure related to anindividual. The new data structure need not be received in anyparticular format but may be represented in any appropriate form such asarrays, digital signals, or the like. The new data structure may bereceived from one or more memories and/or across one or more computernetworks. Alternatively, the processor may receive raw data and convertthe data into a particular data structure. For example, the processormay receive data with time, location, and the like and may convert thisdata into a single bundle (e.g., a data serialization formats, such asJSON, XML, YAML, etc., or any other defined structure of data)representing an event.

At step 1303, the processor may convert the data structure into aBayesian wavelet. For example, as explained above, the processor mayconvert the new data structure (along with any associated properties ormetadata) into a wavelet or into an array or other format thatrepresents a wavelet. Additionally or alternatively, the processor mayconvert raw data received at step 1301 to one or more data serializationformats, such as JSON, XML, YAML, etc., that may be operated on asthough it were a wavelet.

At step 1305, using a tree structure of existing Bayesian waveletsassociated with the individual, the processor may calculate one or moreharmonics. For example, as explained with respect to FIG. 5, Markovianwavelets may describe transition probabilities between the Bayesianwavelets from which the harmonics may be calculated.

At step 1307, the processor may determine a measure of whether theBayesian wavelet alters the one or more harmonics. For example, theprocessor may determine a scalar representing a magnitude of change ofone or more harmonics or a vector representing direction and magnitudeof change of one or more harmonics.

In some embodiments, the processor may further convert the Bayesianwavelet to a tensor. For example, as explained above, the processor mayconvert the wavelet to a tensor based using a moving average, such as asimple moving average, a cumulative moving average, a weighted movingaverage, an exponential moving average, or the like. Accordingly, theprocessor may perform a cascading convolution (e.g., with one or morefilter banks) followed by an accumulation (e.g., using the movingaverage for smoothing) to transform the received wavelet into a tensor.

At step 1309, the processor may add the Bayesian wavelet to the treestructure when the measure is below a threshold. Otherwise, the Bayesianwavelet may be considered anomalous. In such embodiments, the processormay send a notification to such effect. For example, the processor maysend a rejection signal or a message indicating the likelihood and/or areason (e.g., based on the one or more models) for rejection. Theprocessor may send the notification to one or more parties associatedwith the new wavelet (e.g., a financial institution, an individual, amerchant, or the like) and/or to one or more computer systems from whichthe new wavelet was received (e.g., a personal computer such as adesktop computer or mobile phone, a point-of-service system, a financialprocessing server, a credit bureau server, or the like).

In some embodiments, based on the likelihood, the processor may requestadditional information. For example, as explained above, the processormay request a deposit before authorizing a reservation. In anotherexample, the processor may request manual verification beforeauthorizing a transaction.

In embodiments where the Bayesian wavelet is converted to a tensor, themeasure of whether the Bayesian wavelet alters the one or more harmonicsmay be based on a differential field between the tensor and a fieldrepresenting the tree structure. For example, the processor may havepreviously calculated the field using wavelets in the tree structure. Asexplained above, the processor may perform cascading convolution (e.g.,with one or more filter banks) followed by an accumulation (e.g., usingthe moving average for smoothing) to transform the wavelets in the treestructure into tensors and obtain the field by mapping the tensors ontoa manifold (e.g., a differential manifold or the like) using one or moreatlases.

Alternatively, the processor may receive the tensors representing thewavelets in the tree structure (e.g., from one or more memories and/orover one or more computer networks) and construct the field therefrom.Alternatively, the processor may receive the field directly (e.g., fromone or more memories and/or over one or more computer networks).

The disclosed systems and methods may be implemented on one or morecomputing devices. Such a computing device may be implemented in variousforms including, but not limited to, a client, a server, a networkdevice, a mobile device, a laptop computer, a desktop computer, aworkstation computer, a personal digital assistant, a blade server, amainframe computer, and other types of computers. The computing devicedescribed below and its components, including their connections,relationships, and functions, is meant to be an example only, and notmeant to limit implementations of the systems and methods described inthis specification. Other computing devices suitable for implementingthe disclosed systems and methods may have different components,including components with different connections, relationships, andfunctions.

As explained above, FIG. 14 is a block diagram that illustrates anexemplary detection server 1401 suitable for implementing the disclosedsystems and methods. Detection server 1401 may reside on a single serverfarm or may be distributed across a plurality of server farms.

As depicted in FIG. 14, detection server 1401 may include at least oneprocessor (e.g., processor 1403), at least one memory (e.g., memory1405), and at least one network interface controller (NIC) (e.g., NIC1407).

Processor 1403 may comprise a central processing unit (CPU), a graphicsprocessing unit (GPU), or other similar circuitry capable of performingone or more operations on a data stream. Processor 1403 may beconfigured to execute instructions that may, for example, be stored onmemory 1405.

Memory 1405 may be volatile memory (such as RAM or the like) ornon-volatile memory (such as flash memory, a hard disk drive, or thelike). As explained above, memory 1405 may store instructions forexecution by processor 903.

NIC 1407 may be configured to facilitate communication with detectionserver 1401 over at least one computing network (e.g., network 1409).Communication functions may thus be facilitated through one or moreNICs, which may be wireless and/or wired and may include an Ethernetport, radio frequency receivers and transmitters, and/or optical (e.g.,infrared) receivers and transmitters. The specific design andimplementation of the one or more NICs depend on the computing network1409 over which detection server 1401 is intended to operate. Forexample, in some embodiments, detection server 1401 may include one ormore wireless and/or wired NICs designed to operate over a GSM network,a GPRS network, an EDGE network, a Wi-Fi or WiMax network, and aBluetooth® network. Alternatively or concurrently, detection server 1401may include one or more wireless and/or wired NICs designed to operateover a TCP/IP network.

Processor 1403, memory 1405, and/or NIC 1407 may comprise separatecomponents or may be integrated in one or more integrated circuits. Thevarious components in detection server 1401 may be coupled by one ormore communication buses or signal lines (not shown).

As further depicted in FIG. 14, detection server 1401 may include amerchant interface 1411 configured to communicate with one or moremerchant servers (e.g., merchant server 1413). Although depicted asseparate in FIG. 14, merchant interface 1411 may, in whole or in part,be integrated with NIC 1407.

As depicted in FIG. 14, detection server 1401 may include and/or beoperably connected to a database 1415 and/or a storage device 1417.Database 1415 may represent a wavelet database or other digitaldatabase, which may be stored, in whole or in part, on detection server1401 and/or, in whole or in part, on a separate server (e.g., one ormore remote cloud storage servers). Storage device 1417 may be volatile(such as RAM or the like) or non-volatile (such as flash memory, a harddisk drive, or the like).

I/O module 1419 may enable communications between processor 1403 andmemory 1405, database 1415, and/or storage device 1417.

As depicted in FIG. 14, memory 1405 may store one or more programs 1421.For example, programs 1421 may include one or more server applications1423, such as applications that facilitate graphic user interfaceprocessing, facilitate communications sessions using NIC 1407,facilitate exchanges with merchant server 1413, or the like. By way offurther example, programs 1421 may include an operating system 1425,such as DRAWIN, RTXC, LINUX, iOS, UNIX, OS X, WINDOWS, or an embeddedoperating system such as VXWorkS. Operating system 1425 may includeinstructions for handling basic system services and for performinghardware dependent tasks. In some implementations, operating system 1425may comprise a kernel (e.g., UNIX kernel). Memory 1405 may further storedata 1427, which may be computed results from one or more programs 1421,data received from NIC 1407, data retrieved from database 1415 and/orstorage device 1417, and/or the like.

Each of the above identified instructions and applications maycorrespond to a set of instructions for performing one or more functionsdescribed above. These instructions need not be implemented as separatesoftware programs, procedures, or modules. Memory 1405 may includeadditional instructions or fewer instructions. Furthermore, variousfunctions of detection server 1401 may be implemented in hardware and/orin software, including in one or more signal processing and/orapplication specific integrated circuits.

The foregoing description has been presented for purposes ofillustration. It is not exhaustive and is not limited to precise formsor embodiments disclosed. Modifications and adaptations of theembodiments will be apparent from consideration of the specification andpractice of the disclosed embodiments. For example, the describedimplementations include hardware and software, but systems and methodsconsistent with the present disclosure can be implemented with hardwarealone. In addition, while certain components have been described asbeing coupled to one another, such components may be integrated with oneanother or distributed in any suitable fashion.

Moreover, while illustrative embodiments have been described herein, thescope includes any and all embodiments having equivalent elements,modifications, omissions, combinations (e.g., of aspects across variousembodiments), adaptations and/or alterations based on the presentdisclosure. The elements in the claims are to be interpreted broadlybased on the language employed in the claims and not limited to examplesdescribed in the present specification or during the prosecution of theapplication, which examples are to be construed as nonexclusive.

Instructions or operational steps stored by a computer-readable mediummay be in the form of computer programs, program modules, or codes. Asdescribed herein, computer programs, program modules, and code based onthe written description of this specification, such as those used by theprocessor, are readily within the purview of a software developer. Thecomputer programs, program modules, or code can be created using avariety of programming techniques. For example, they can be designed inor by means of Java, C, C++, assembly language, or any such programminglanguages. One or more of such programs, modules, or code can beintegrated into a device system or existing communications software. Theprograms, modules, or code can also be implemented or replicated asfirmware or circuit logic.

The features and advantages of the disclosure are apparent from thedetailed specification, and thus, it is intended that the appendedclaims cover all systems and methods falling within the true spirit andscope of the disclosure. As used herein, the indefinite articles “a” and“an” mean “one or more.” Similarly, the use of a plural term does notnecessarily denote a plurality unless it is unambiguous in the givencontext. Words such as “and” or “or” mean “and/or” unless specificallydirected otherwise. Further, since numerous modifications and variationswill readily occur from studying the present disclosure, it is notdesired to limit the disclosure to the exact construction and operationillustrated and described, and accordingly, all suitable modificationsand equivalents may be resorted to, falling within the scope of thedisclosure.

Other embodiments will be apparent from consideration of thespecification and practice of the embodiments disclosed herein. It isintended that the specification and examples be considered as exampleonly, with a true scope and spirit of the disclosed embodiments beingindicated by the following claims.

What is claimed is:
 1. A system for generating a persona using a hashtree, the system comprising: one or more memories storing instructions;and one or more processors configured to execute the instructions to:receive a plurality of data structures related to an individual, convertthe data structures into a plurality of Bayesian wavelets, group theBayesian wavelets into a tree structure, using transitions between theBayesian wavelets within the tree structure, generate a plurality ofMarkovian wavelets representing the transitions, replace one or more ofthe Bayesian wavelets with hashes, and output the tree structure as apersona representing the individual.
 2. The system of claim 1, whereinthe one or more processors further execute the instructions to convertthe Bayesian wavelets to tensors that are output with the treestructure.
 3. The system of claim 2, wherein converting the wavelet to atensor includes applying a discrete wavelet transform.
 4. The system ofclaim 3, wherein the discrete wavelet transform includes a filter bankcomprising a plurality of convolutional-accumulators.
 5. The system ofclaim 4, wherein the convolutional accumulators are configured toaccumulate using base e.
 6. The system of claim 4, wherein the discretewavelet transform includes an exponential smoothing average in thefilter bank.
 7. A system for training a deep field network to detectanomalies within a hash tree, the system comprising: one or morememories storing instructions; and one or more processors configured toexecute the instructions to: receive a plurality of tree structuresrepresenting individuals, each tree structure including Bayesianwavelets and Markovian wavelets governing transitions between theBayesian wavelets, group the Bayesian wavelets in the tree structures bycoefficients, train a neural network for each group independently ofother groups, and integrate the neural networks into a deep fieldnetwork.
 8. The system of claim 7, wherein each neural network isfurther trained specific to at least one of a particular tree structure,a particular location, or a particular time of day.
 9. The system ofclaim 7, wherein the one or more processors further execute theinstructions to convert the Bayesian wavelets to tensors further used totrain the neural network for each group.
 10. The system of claim 9,wherein converting the wavelets to tensors includes applying a discretewavelet transform.
 11. The system of claim 10, wherein the discretewavelet transform is performed using a filter bank having a plurality ofconvolutional-accumulators.
 12. The system of claim 11, wherein theconvolutional accumulators are configured to accumulate using base e.13. The system of claim 11, wherein the discrete wavelet transformincludes an exponential smoothing average in the filter bank. 14-20.(canceled)